OAuth Consent Phishing n'okusazaamu Olukusa lwa App ez'abantu ab'okusatu olw'obulabe¶

Teebereza okukizuula nti omulumbaganyi asoma nnyo email zo ez’ekyama, ng’awanula ebiwandiiko byo eby’ekire, ng’akola amateeka agakwata ku kuweereza mu inbox mu kasirise, oba ng’ateeka enkolagana z’obufere okuva ku akawunti yo, ne bwe kiba nti omaze okukyusa password yo n’ogifuula ey’ennukuta 24 ezitali za bulijjo n’asobozesa hardware Two-Factor Authentication (2FA / Passkeys). Omulumbaganyi akyali atya munda mu akawunti yo eya Google Workspace, Microsoft 365, GitHub, Slack, oba Discord nga tamanyi password yo empya oba okutandikawo 2FA prompt emu? Kubanga wagwa mu buzibu bwa OAuth 2.0 Consent Phishing (era emanyiddwa nga Illicit Consent Grant oba Device Code Phishing). Mu kifo ky’okukulimbalimba n’owandiika ekigambo kyo eky’okuyingira ku mukutu gw’okuyingira ogw’ekicupuli, omulumbaganyi yakusindikira enkolagana n’eya nnamaddala accounts.google.com oba login.microsoftonline.com olukusa screen nga lubuuza oba app etuumiddwa erinnya "PDF Document Viewer," "eSign Security Check," "Zoom Meeting Recorder," oba "Mail Backup Assistant" could have permission to "Soma, okuwandiika, okusindika, n'okusazaamu enkalakkalira email yo yonna okuva ku Gmail" oba "Okubeera n'obuyinza obujjuvu ku fayiro zonna z'olina."

Akaseera ke wanyiga Allow oba ** .Accept** ku kasanduuko ako akatuufu aka Microsoft oba Google, omuwa endagamuntu yafulumya seva y’omulumbaganyi ekiwandiiko ekikusike ekiwangaala OAuth Refresh Token (offline_access). Kubanga OAuth 2.0 API tokens zikakasa butereevu ku backend REST/Graph APIs (graph.microsoft.com oba gmail.googleapis.com) nga tekyetongodde ddala ku lutuula lwo olw’omukutu gw’omuntu, okukyusa password yo oba okwongerako 2FA kitera okuleka malicious third-party app grants 100 percent active. Okusiba omulumbaganyi ebweru okumala ebbanga lyonna, olina okusazaamu mu ngalo ensimbi z’okukozesa ez’ekibiina eky’okusatu, okutta obubonero bwonna obw’okuzza obuggya n’okuyingira obwa OAuth obufulumiziddwa, n’okulongoosa enzigi zonna ez’emabega app ze yatonda nga erina API.

Kino kikole kati¶

1. Tegera mangu lwaki okukyusa password yo TEKIyimiriza hacker: olina okusazaamu... Third-Party App / OAuth Consent Grant munda mu mukutu gw’obukuumi bwa akawunti yo. Bw’onyiga Allow ku screen ya OAuth, okola endagaano ya API etaggwaawo okuva ku kyuma ku kyuma (Service Principal / OAuth App Token). Genda butereevu ku mukutu gw'omugabi wo ogwa Third-Party Apps & Services kati kati (myaccount.google.com/connections ku Google, myapps.microsoft.com oba account.live.com/consent/Manage ku lwa Microsoft, github.com/settings/applications ku GitHub) n’onyiga Remove Access / Revoke ku buli nkola gy’otomanyi kikumi ku kikumi era gy’otamanyi.
2. Bw’oba owandiise koodi ya alphanumeric ey’ennukuta 8 oba 9 mu microsoft.com/devicelogin, . google.com/device, oba github.com/login/device mu kiseera ky’okukuba essimu oba okukubaganya ebirowoozo ku phishing, sazaamu byombi byo Active Device Sessions ERA OAuth App Grants amangu ago. Mu Olulumba lw'okubbira mu kutambula kwa koodi y'ekyuma (RFC 8628), omulumbaganyi akola code ya smart-TV/CLI pairing ku kompyuta yaabwe n’akulimba n’owandiika code eyo ku real microsoft.com/devicelogin omuko. Okuwandiika code eyo kikwasa omulumbaganyi primary ** .Refresh Token (PRT / . Multi-Resource Refresh Token)** eyeefudde kasitoma wa Microsoft Office, Azure CLI, oba Apple Internet Accounts enzaalwa.
3. Oluvannyuma lw'okusazaamu app ya OAuth embi, obala mangu Email yo Forwarding Rules, . Inbox Filters, era Delegated Mailbox Access okuyita mu Graph/Gmail UI. Kintu ki ekisookera ddala app ya OAuth embi ky’ekola mu kisooka 500 milliseconds oluvannyuma lw’okunyiga Allow? Ekozesa enkola ya... Mail.ReadWrite oba MailboxSettings.ReadWrite API scope okufuyira etteeka lya inbox ku ludda lwa seva eritalabika eriweereza buli email eyingidde mu bbanka, crypto, oba password-reset eri omulumbaganyi era n’eyisa eby’okuddamu butereevu ku byo Trash oba RSS Feeds folda (laba Email account hacked: amateeka g'okuweereza n'okuzzaawo).
4. Kebera oba app ya OAuth embi yawandiisa app ya OAuth ey’okubiri ey’okutereka, Personal Access Token (PAT), SSH Key, oba enkola ya MFA ate nga yalina obuwanvu bw'okuddukanya. Mu Microsoft Entra ID (Azure AD), GitHub, ne Google Workspace, app ekkirizibwa obuwanvu bwa dayirekita oba okuddukanya akawunti (Application.ReadWrite.All, . RoleManagement.ReadWrite.Directory, oba GitHub admin:public_key) asobola okukola mu kasirise akabonero ka API akakusike * ak’okubiri* oba omukulu w’empeereza kale omulumbaganyi asigala n’okuyingira oluvannyuma lw’okusazaamu app esooka.
5. Singa kino kyaliwo ku kkampuni oba essomero Microsoft 365 oba Google Workspace akawunti yo, kuba ku IT Security / SOC Helpdesk yo mu ddakiika 5. Omukozi omu ng’anyiga Accept ku OAuth phishing link esobola okuwa omulumbaganyi okusoma okuyingira mu kampuni yonna SharePoint, OneDrive, Teams chats, ne Global Address List, okutongoza Business Email Compromise ey'omunda (BEC) okulumba bakozi banno ne bakasitoma bo mu ngeri ey’okufera waya.
6. **Singa omulumbaganyi yakozesa OAuth access okulaba cloud drives zo (Google Drive / . OneDrive); Okuddamu okumenya data n’okuvuba kw’ebigambo by’okuyingira).

flowchart TD
    A["Okuteeberezebwa nti OAuth Consent Phishing oba Okuyingirira Akawunti Okutaggwaawo Oluvannyuma lw'okuzzaawo Password"] --> B["1. Ggulawo Omukutu gw’Olukusa ku App ez’abantu ab’okusatu (Google Connections / Microsoft MyApps / GitHub Applications)"]
    B --> C["2. Screenshot apps z’otomanyi okufuna obujulizi, olwo onyige ‘Revoke / Remove Access’ ku buli OAuth App eteeberezebwa"]
    C --> D{"Wayingiza koodi ku lupapula lw'okuyingira kw'Ekyuma (e.g., microsoft.com/devicelogin)?"}
    D -->|"Yee: ​​Okubba Koodi y'Ekyuma (RFC 8628) ."| E["Kola 'Sign Out Everywhere / Revoke All Refresh Tokens' okutta entuula za CLI / Device Code enzaaliranwa"]
    D -->|"Nedda: Ensimbi ya Standard Web OAuth"| E
    E --> F["3. Audit & Delete Secondary Backdoors Ezikoleddwa API Token"]
    F --> G["Kebera Amateeka ga Email Inbox, Auto-Forwarding, & Okuyingira okuweereddwa (Gmail / Outlook)"]
    F --> H["Kebera obubonero bw'okuyingira kw'omuntu (PATs), Ebisumuluzo bya SSH, & Webhook Integrations"]
    F --> I{"Eno yali Akawunti ya Microsoft 365 / Google Workspace ey'ekitongole?"}
    I -->|"Yee"| J["Labula Enterprise Admin / SOC amangu ddala okusazaamu ServicePrincipal Grant mu Entra ID / Workspace Admin"]
    I -->|"Nedda (Akawunti ey’obuntu) ."| K["Kyusa password + Kakasa ebyuma bya MFA + Kebera Cloud Drive Download Activity Logs"]

Engeri OAuth 2.0 Consent Phishing gy’eyitamu ebigambo ebikusike ne 2FA (Technical Anatomy)¶

Lwaki balina ebibiina by’abamenyi b’amateeka ku mikutu gya yintaneeti, ebibiina by’amawanga-eggwanga ebikessi (Midnight Blizzard, . Star Blizzard), era abafulumya ssente za crypto bakyuse nnyo okuva ku bufere obw’ennono obw’okuyingira mu bicupuli okudda ku OAuth Consent Phishing ne Device Code Phishing?

1. Okubba ennono vs. OAuth Consent Phishing vs. Okubba Koodi y'Ekyuma¶

2. Okusaba kw'abalumbaganyi b'olukusa lwa OAuth olw'akabi ennyo¶

Bw’oba okebera app mu lukalala lw’olukusa lwo, tunuulira bulungi scopes ze yasaba: * Ekifaananyi kya Microsoft (Entra ID / Microsoft 365 / Outlook.com): * Mail.Read, . Mail.ReadWrite, . Mail.Send, . MailboxSettings.ReadWrite (Ekkiriza okusoma email zonna, okuweereza email nga ggwe, n'okukola amateeka agakwekebwa mu kuweereza inbox). * Files.Read.All, . Files.ReadWrite.All, . Sites.ReadWrite.All (Ekkiriza okuwanula buli fayiro mu OneDrive yo ne buli folda ya SharePoint ey’ekitongole egabanyizibwa). * offline_access (Esobozesa seva y’omulumbaganyi okukola mint mu kasirise Access Tokens empya ddala 24/7 ne bwe kiba nti kompyuta yo eggaddwa). * Directory.ReadWrite.All, . AppRoleAssignment.ReadWrite.All, . User.ReadWrite.All (Ebifo eby’okulinnyisa enkizo z’ebitongole eby’akatyabaga). * Ekifo ky'okukoleramu Google / Gmail ey'obuntu (Google APIs): * https://mail.google.com/ oba gmail.modify / . gmail.settings.basic / . gmail.settings.sharing (Obufuzi obujjuvu ku kusoma, okusazaamu, n'okuweereza Gmail). * https://www.googleapis.com/auth/drive (Okusoma/okuwandiika/okuwanula mu bujjuvu okutuuka ku buli fayiro mu Google Drive yo). * https://www.googleapis.com/auth/cloud-platform (Okufuga mu bujjuvu enkola ya Google Cloud n’okusasula ssente). * GitHub & Enkola z'obutonde bw'ensi ez'abakugu (GitHub Apps / . OAuth Apps): * repo era workflow (Okuyingira mu bujjuvu mu kusoma/okuwandiika mu tterekero lyonna ery'obwannannyini erya source-code n'olukusa okufuyira payipu ezibba ebyama ebya GitHub Actions CI/CD eby'obulabe). * admin:org, . admin:public_key, era admin:gpg_key (Olukusa okwongera ebisumuluzo bya SSH eby'emabega ebitaggwaawo oba okukyusa obwammemba bw'ekitongole). * Slack & Discord Ebifo bya OAuth: * Slack mu ngeri ey’ekibogwe channels:history, . groups:history, . im:history, . files:read, era chat:write (Ekkiriza app ey’ebweru okusoma obubaka bwonna obutereevu obwa ttiimu ey’obwannannyini, okusenya PDF n’ebiwandiiko ebiraga nti biteekeddwa ku mukutu, n’okuweereza enkolagana z’obufere nga yeefuula mukozi munno eyesigika). * Obutakkaanya guilds.join era identify (Ekkiriza bot oba omukutu gw'okukakasa ogukoseddwa okwegatta mu ngeri ey'amaanyi akawunti yo eya Discord mu seeva z'emivuyo enfunda n'enfunda nga tokkirizza).

Omutendera 1: Omutendera ku mutendera OAuth & Third-Party App okusazaamu ku buli musingi omukulu¶

Goberera emitendera emituufu wansi ku buli akawunti gye wanyiga ku link eteeberezebwa, gye wakozesa "Sign in with Google / Microsoft / Apple / GitHub / Discord" ku mukutu oguteesigika, oba we walabye emirimu egitakkirizibwa.

1. Akawunti ya Google (Personal Gmail & Google Workspace) .¶

1. Ggulawo browser ogende butereevu ku: https://myaccount.google.com/connections (oba genda ku myaccount.google.com -> nyweza Security mu menu eya kkono -> genda wansi ku Enkolagana yo ku apps & services ez'abantu ab'okusatu -> nyweza Laba enkolagana zonna).
2. Filter by Risk: Nywa ku chip y'okusengejja waggulu ewandiikiddwako Access to your Google Account (esengejja okuyingira okutali kwa bulabe okwa "Sign in with Google" amannya gokka n'okulaga apps ezirina olukusa lwa API olukola okusoma Gmail yo, Google Drive, Calendar, oba Contacts).
3. Nywa ku buli app gy’otomanyi, eteeberezebwa, oba etakyakozesebwa (weegendereze amannya ag’obulimba agakoppa ebikozesebwa mu nkola nga "Google Docs Viewer," "PDF Converter," "Email Cleaner," "eFax," oba "Drive Backup").
4. Ssenda wansi ku Laba ebisingawo olabe olunaku n'essaawa entuufu okuyingira kwe kwakkirizibwa n'obuwanvu ki (Gmail, . Google Drive) kikwata.
5. Nyiga ku Delete all connections you have with [App Name] -> Nywa ku Kakasa.
6. Era Okusazaamu Entuula z'Ekyuma Ezikola (Ku Phishing Ya Koodi y'Ekyuma): Genda ku https://myaccount.google.com/device-activity era n'ofuluma mu kiseera kyonna ky'otomanyidde Linux, Windows, Mac, oba Smart TV device session.

2. Microsoft ey’obuntu (Outlook.com / Hotmail / Live / Xbox) vs. Ebitongole (Microsoft 365 / Entra ID) .¶

Microsoft ekozesa emikutu ebiri egy’enjawulo okusinziira ku oba akawunti yo akawunti ya bakozesa ssekinnoomu oba akawunti ya mulimu/essomero:

A. Akawunti za Microsoft ez’obuntu (@outlook.com, . @hotmail.com, . @live.com) .¶

1. Genda butereevu ku: https://account.live.com/consent/Manage (oba genda ku account.microsoft.com/privacy -> Apps ne services ezisobola okuyingira mu data yo).
2. Kebera buli nkola ewandiikiddwa. Bwoba olaba app yonna gyotamanyi (oba legitimate-sounding client nga eM Client, . Thunderbird, oba Mail App nti tossaako ggwe kennyini, akakodyo aka bulijjo akakozesebwa abalumbaganyi okufuna obubonero bwa IMAP/Graph OAuth), nyweza Edit wansi wa app eyo onyige Remove these permissions.
3. Ekiddako, genda ku https://account.microsoft.com/security -> Ddukanya engeri gye nyingira -> genda wansi onyige Sign me out (ekiwaliriza okulemesa ensi yonna mu bulawuzi zonna, apps, n'entuula za Xbox/OneDrive mu ssaawa 24).

B. Ebitongole / Emirimu / Essomero Microsoft 365 & Microsoft Entra ID (Azure AD)¶

1. Nga Omukozesa Omukozi Omuntu:
2. Genda ku https://myapps.microsoft.com -> Nywa ku kabonero ka profile yo oba akabonero ka gear -> Nywa ku Profile oba koona ku bubonero busatu (...) ku tile yonna eya app gy'otomanyi -> Londa Ddukanya enkola yo -> Sazaamu olukusa.
3. Era genda ku https://myaccount.microsoft.com -> Security info -> kakasa nti tewali app ya Authenticator ya mufere eyongezeddwa, era onyige Sign out everywhere wansi w’ekitundu Overview.
4. Nga Microsoft 365 / Entra ID Administrator (Okulongoosa akabonero ka PowerShell ak'amangu & Okukkiriza): Omukozi bw’agwa ku OAuth Consent Phishing oba Device Code Phishing mu mupangisa w’ekitongole, okumala okusazaamu app okuva ku mukutu gwa MyApps ogw’omukozesa tekimala; admin alina okusazaamu OAuth2PermissionGrant okubuna omupangisa n'okufuula eby'omukozesa obutaba bituufu RefreshTokensValidFromDateTime ng’oyita mu Microsoft Graph PowerShell:

# Connect to Microsoft Graph with Directory & Delegated Permission Grant Administrator privileges:
Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All", "DelegatedPermissionGrant.ReadWrite.All", "Application.ReadWrite.All"

# 1. Inspect all OAuth2 Delegated Permission Grants for the compromised user:
$User = Get-MgUser -UserId "victim@yourdomain.com"
Get-MgUserOauth2PermissionGrant -UserId $User.Id | Format-List Id, ClientId, ConsentType, Scope, ResourceId

# 2. Immediately delete the malicious OAuth2PermissionGrant by its Grant Id:
Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId "<Grant-ID-From-Step-1>"

# 3. Remove the malicious Enterprise Application (ServicePrincipal) from the entire tenant so no other employee is affected:
Remove-MgServicePrincipal -ServicePrincipalId "<Malicious-ClientId-ObjectId>"

# 4. Revoke ALL active OAuth Refresh Tokens and Continuous Access Evaluation (CAE) sessions for the user immediately:
Revoke-MgUserSignInSession -UserId $User.Id

3. GitHub, Slack, Obutakwatagana, Apple (Sign in with Apple), ne X / Akawunti z’Ensi¶

Abalumbaganyi batunuulira nnyo akawunti z’abakugu, ez’omukitundu, n’ez’omukwano n’obufere bwa OAuth okusika ebikolwa bya koodi embi, okufulumya ebitundu bya Discord, oba okuteeka enkolagana z’okufulumya ssente za cryptocurrency:

Omutendera 2: Okuyigga okugumiikiriza okw’okubiri okulekebwa emabega app ya OAuth embi¶

1. Amateeka g’Email Inbox, Auto-Forwarders, n’Amateeka g’okusenya okukwese (Gmail & Outlook / M365) .¶

Singa app ya OAuth eyali embi yalina Mail.ReadWrite oba MailboxSettings.ReadWrite olukusa: * Mu Gmail: Nywa ku Gear Icon (waggulu ku ddyo) -> Laba ensengeka zonna. 1. Nyiga ku Forwarding and POP/IMAP tab -> Kakasa ekyo Forwarding eteekeddwa ku Disable forwarding era tewali ndagiriro ya email etamanyiddwa ewandiikiddwa. 2. Nyiga ku Filters and Blocked Addresses tab -> Noonya omusengejja gwonna ogukwatagana from:(*) oba ebigambo ebikulu nga bank, . wire, . invoice, . coinbase, . password, oba security n'ekikolwa ** .Delete it, ** .Skip the Inbox (Archive it), oba ** .Forward it to** -> Ssaawo ebisengejja ebyo amangu ddala. 3. Nyiga ku Accounts and Import tab -> Wansi wa Grant access to your account (Delegated access) ne Send mail nga, ggyawo endagiriro yonna gy'otomanyi. * Mu mukutu gwa Microsoft Outlook (outlook.office.com oba outlook.live.com): Nywa ku Gear Icon (waggulu ku ddyo) -> Mail. 1. Nyiga ku Rules -> Ssaako buli tteeka ly'otomanyi (abalumbaganyi batera okutuuma amannya g'amateeka ag'obulabe . oba ... oba Security Sync era ozitegeke okutambuza email eziyingira mu... RSS Subscriptions oba Conversation History folda nga oziteekako akabonero nti Soma). 2. Nyiga ku Forwarding (ne Junk email) -> Kakasa nti Enable forwarding tewali kabonero, era osazeewo domain yonna ey'omulumbaganyi eyongezeddwa ku lukalala lwa Safe senders and domains.

2. Cloud Drive Mass-Download Audit & "Okugabana enkolagana" Emiryango gy'emabega (Google Drive & OneDrive / SharePoint) .¶

Lumu app ya OAuth erina Files.ReadWrite.All oba drive scope, ekola ebintu bibiri: ekisooka, ewanula PDF zo ezikwata ku nsonga, spreadsheets, ne password files; ekyokubiri, esobola okukyusa mu kasirise olukusa lw’okugabana ku folda zo ez’ekyama okudda ku ** ."Anyone with the link can view/edit"** kale omulumbaganyi akyayinza okuggulawo ebitabo ebyo mu browser etamanyiddwa mannya ne bw’omala okusazaamu app ya OAuth. * Mu Google Drive: Nywa ku (i) View Details (Activity) icon mu nsonda eya waggulu ku ddyo okulaba buli fayiro etunuuliddwa, ekyusiddwa, oba egabanyizibwa mu nnaku 7 eziyise. Oluvannyuma wandiika ** .is:unorganized, ** .sharedwith:public, oba ** .sharedwith:external** mu bbaala y’okunoonya eya Google Drive waggulu okuzuula fayiro oba ebitabo byonna omulumbaganyi bye yakola okutuukirirwa mu lujjudde. * Mu Microsoft OneDrive: Genda ku Shared -> Shared by you tab ku menu eya kkono era osazeewo link yonna ey'olukale (Anyone with the link) tewatonda.

3. Ekiwandiiko kya Google Apps (script.google.com) & Microsoft Power Automate (make.powerautomate.com) Ebiziyiza¶

Wano waliwo akakodyo k’okugumiikiriza akakozesebwa ku bakozesa Google ne Microsoft 365: ng’ali munda mu akawunti yo, omulumbaganyi akola layini 10 Google Apps Script (ku https://script.google.com/home/triggers) oba Microsoft Power Automate Cloud Flow (ku https://make.powerautomate.com) eteekeddwa okutambula ku ssaawa ya ddakiika 5 (Time-driven trigger oba When a new email arrives). Olw’okuba script eyo ekola natively munda mu cloud account yo, esigala efulumya emails zo buli luvannyuma lwa ddakiika 5 ne bw’oba ​​okyusizza password yo n’okusazaamu apps ez’ebweru. * Ggulawo https://script.google.com/home/triggers (ku Google) oba https://make.powerautomate.com -> My flows (for Microsoft 365) right now era osazaamu script yonna oba automated flow yonna gyotawandiika kinnoomu.

4. Okubala ebitabo by’okubala ebitabo by’ekire okusobola okusengejja Data (Google Takeout, . Entra Sign-In Logs, & . Unified Audit Log) .¶

Bw’oba ​​weetaaga okumanya ddala email oba fayiro ki enkola ya OAuth embi gye yasoma oba gye yawanula ng’akabonero kaayo kakola: * Ku Akawunti za Google ez'obuntu: Ggulawo https://myactivity.google.com ne ** .https://myaccount.google.com/notifications** okwekenneenya ebibaddewo mu by'okwerinda ebisembyeyo n'okukebera oba Google Takeout archive export yasabibwa. * Ku Google Workspace (Admin Console): Genda ku admin.google.com -> Reporting -> Audit and investigation -> OAuth log events ne ** .Drive log events** esengekeddwa omukozesa alina obuzibu n'omukozi omubi Client ID okufuna olukalala olujjuvu oluliko sitampu y'ebiseera eya buli ID ya fayiro eyingiziddwa. * Ku Microsoft 365 (Purview / . Entra ID): Okuggula entra.microsoft.com -> Identity -> Monitoring & health -> Sign-in logs, nyweza ku Non-interactive user sign-ins ne ** .Service principal sign-ins** tabs (standard Interactive Sign-In logs TEZIlaga background OAuth token refreshes), era okusengejja okusinziira ku kizibu Application ID okulaba buli IP address n'okuyita eby'obugagga ebikolebwa omulumbaganyi.

5. Okukyusakyusa Ebyama Ebibikkuddwa Ebisangibwa Munda Mu Cloud Drive oba Email Yo¶

Singa app ya OAuth embi yalina obuyinza okuyingira mu tterekero lyo erya Gmail, Outlook, Google Drive, OneDrive, oba GitHub okumala wadde sekondi 60, kitwale nti omulumbaganyi yaddukanya automated regex scraper okuyita mu mailbox yo ne drive ng’anoonya: 1. Ebigambo by'ensigo za Cryptocurrency (12/24-word BIP-39 mnemonics) oba Wallet .json Keystores: Singa ekifaananyi oba ekiwandiiko ekirimu ekigambo ky’ensigo ya crypto kyali mu cloud drive oba email yo, ensimbi zonna zitambuze mu nsigo ya hardware wallet empya ddala (laba Cryptocurrency waleti drain n'ensigo ebigambo okukkaanya). 2. Omuddukanya Password eyafulumizibwa ebweru .csv Fayiro oba Ebiwandiiko by’Omusolo (Form 1040 / W-2): Zingulula password zo era oziyize ebifo byo eby'okuwola (Equifax, . Experian, . TransUnion) amangu ago. 3. Ebisumuluzo bya API by'omukugu (AWS_SECRET_ACCESS_KEY, . Stripe, . OpenAI, . GitHub PATs, . .env files): Sazaamu era oyiringisize buli kyama ky’ebizimbe by’ekire ekyalabika mu email zo, obubaka bwa Slack, oba ebiwandiiko by’ekire.

Olukalala lw'okukebera okuziyiza: okuyimiriza OAuth & Device Code phishing enkalakkalira¶

• Tokkirizangako app ey'ebweru ejjudde Read/Write Email oba Full Cloud Drive olukusa okulaba PDF emu yokka, okuyita kwa kalenda, oba omugaso: Omukutu omutuufu ogw'okulaba ebiwandiiko tekyetaaga lukusa "Soma, okuwandiika, okusindika, n'okusazaamu enkalakkalira email yo yonna okuva ku Gmail." Singa olutimbe lw'okukkiriza kwa OAuth olutasuubirwa lusaba obuwanvu bwa mailbox oba drive scopes, ggalawo tab amangu ddala.
• Towandiikangako a Device Login Code (microsoft.com/devicelogin oba google.com/device) ekuweerezeddwa omuntu omulala mu email, text, oba chat: Device codes (RFC 8628) zibeera nnyo ku screen za hardware etudde mu mubiri mu maaso go mu kisenge kimu (nga Apple TV yo ey’omu ddiiro oba SSH terminal yo). Singa omuntu omulala akola code y'ekyuma n'akusaba okugiwandiika, oba oyingiza kompyuta ye mu akawunti yo.
• Ku Microsoft 365 / Google Workspace Admins: Lemesa End-User OAuth App Okukkiriza era oziyize Okutambula kwa Koodi y'Ekyuma ng'oyita mu Kuyingira okw'obukwakkulizo:
• Mu Ekifo ky'abaddukanya Microsoft Entra (entra.microsoft.com) -> Endagamuntu -> Enkola -> Enkola z'ekitongole -> Okukkiriza n'olukusa -> Enteekateeka z'okukkiriza kw'omukozesa, kyusa okuva ku Kiriza okukkiriza kw'omukozesa ku pulogulaamu okudda ku Do not allow user consent (era sobozesa Admin Consent Workflow abakozi ne banyiga "Request Approval" mu kifo ky'okukkiriza apps ez'obufere okuyingira).
• Mu Google Workspace Admin Console (admin.google.com) -> Obukuumi -> Okuyingira n'okufuga data -> Okufuga API -> Dukanya Third-Party App Access, teekawo ebifo eby'akabi ennyo (Gmail, . Drive) okutuuka ku ** .Trusted: Can only access Google data if explicitly allowlisted by an admin**.
• Tonda Entra ID Conditional Access Policy nga oziyiza ** .Device Code Flow** enkola y'okukyusa okukakasa eri abakozesa bonna abatali ba developer.

Ebibuuzo ebitera okubuuzibwa¶

Lwaki okukyusa password yange n'okutandika Two-Factor Authentication (2FA) tekyagoba app ya OAuth embi?¶

Passwords ne Two-Factor Authentication zikuuma oluggi lw’emmanju lwokka ng’omuntu ayingidde ng’ayita mu screen y’okuyingira. Bw’onyiga `Allow` ku kibuuzo ky'okukkiriza ekya OAuth 2.0, olagira Google, Microsoft, GitHub, oba Discord okufulumya ekiwandiiko ekikusike `Refresh Token` butereevu ku seva y’enkola eyo ey’omuntu ow’okusatu app esobole okukola mu mugongo ng’oli ku mukutu. Okusinziira ku nteekateeka y’ebizimbe, emikutu mingi gikkiriza okugatta kw’abantu ab’okusatu okukkirizibwa (nga ebikozesebwa mu kukwataganya kalenda, empeereza z’okutereka, oba ebiyungo bya CRM) okusigala nga bitambula mu nkyukakyuka z’ebigambo by’okuyingira eza bulijjo okuggyako ng’ogenda mu bulambulukufu ku lupapula lwo olwa Third-Party App Connections n’onyiga **Revoke / Remove Access**.

Omukago gwa OAuth phishing gwali guyinza gutya okulaga accounts.google.com oba login.microsoftonline.com nga erina HTTPS padlock entuufu singa yali mufere?¶

Mu bulumbaganyi bwa OAuth Consent Phishing, omumenyi w’amateeka takola mukutu gwa yintaneeti ogw’ekicupuli; mu kifo ky’ekyo, bawandiisa enkola ya developer ey’obwereere munda mu Google Cloud oba Microsoft Azure (etwala eddakiika 2) ne bakuweereza enkolagana entuufu eya Google oba Microsoft authorization link erimu app zaabwe `client_id`. Olw’okuba okyalidde seva ya Google oba Microsoft ey’okuyingira entuufu, erinnya lya domain ne satifikeeti ya SSL bituufu ebitundu 100 ku 100. Obulimba buli mu **ani nnannyini linnya lya app y'omuntu ow'okusatu** ng'asaba olukusa ng'omaze okuyingira; okunyiga `Allow` agamba seva ya Google oba Microsoft entuufu okukwasa data yo eri app y’omumenyi w’amateeka eyawandiisibwa.

"Okubba Koodi y'Ekyuma" kye ki (microsoft.com/devicelogin), era lwaki kya kabi nnyo?¶

Ensimbi eziweebwa olukusa lw’ebyuma bya OAuth 2.0 (`RFC 8628`) yatondebwa osobole okuyingira mu byuma ebitaliiko web browser oba keyboard, gamba nga Smart TV oba command-line interface (CLI): TV eraga code ey’ennukuta 8 n’ekugamba okuggulawo `microsoft.com/devicelogin` ku ssimu yo oyingize code eyo. Mu kulumba kwa Device Code Phishing, omubbi akola script (`TokenTactics` oba `RoadTools`) ku kompyuta yaabwe okukola code empya ey’ennukuta 8, olwo ne bakuweereza email oba obubaka ku Teams/Slack nga bagamba nti olina okuyingiza code eyo ku `microsoft.com/devicelogin` okulaba ekiwandiiko ekikuumibwa oba okukakasa akawunti yo. Omulundi ogwokubiri bw’owandiika koodi yaabwe ku mukutu gwa Microsoft ogwa nnamaddala, Microsoft eyingiza kompyuta y’omubbi butereevu mu akawunti yo ng’ebiwandiiko ebijjuvu ebya Multi-Factor Authentication bimaze okumatizibwa.

Standard "Sign in with Google" oba "Sign in with Apple" ya bulabe singa popup ebuuza Erinnya lyange ne Email Address yokka?¶

Omutindo OpenID Okuyunga (`OIDC`) "Yingira ne Google / Apple / Microsoft" ekusaba nti **yokka** okusaba profile yo enkulu (`Name`, . `Email address`, era `Profile picture`) mu butuufu zirina obukuumi bungi okusinga okuwandiika ekigambo ky’okuyingira ku mukutu omupya, kubanga omukutu gw’omuntu ow’okusatu tegulabangako kigambo kyo era tegufuna zero access ku emails oba files zo. Obulabe bubaawo nga ekipande ky'okukkiriza kisaba **ebifo ebirala ebikulu ebya API**, nga *"Soma, wandiika, sindika, era osazeewo enkalakkalira email yo yonna,"* *"Laba, longoosa, tonda, era osazeewo fayiro zo zonna eza Google Drive,"* oba *"Weegatte ku seeva ku lulwo."* Bulijjo soma olukalala lw'olukusa oluliko amasasi ku screen y'okukkiriza nga tonnanyiga Continue.

Ebiragiro ebikwatagana nabyo¶

• MFA phishing ne Adversary-in-the-Middle (AiTM) okuyita ku nsonga eno
• Okuwamba kuki z'olutuula, infostealer malware, n'okusazaamu ebisumuluzo by'okuyita
• Email account hacked: amateeka g'okuweereza n'okuzzaawo
• Corporate Business Email Compromise (BEC) n’okujjukira emivuyo gya waya
• Okugaziya ku browser okw’obulabe, abawamba clipboard, n’okuggyawo adware
• Ennamba z’ensi yonna ez’amangu

Ensonda zeekebeddwa¶

• Ekitongole ky’obukuumi ku mikutu gya yintaneeti n’ebizimbe (CISA) & Federal Bureau of Investigation (FBI) (United States): Okuwabula okw’awamu ku by’okwerinda ku mikutu gya yintaneeti ku nsimbi ezikkirizibwa OAuth ezitali mu mateeka, Device Code Phishing (RFC 8628), n’Obubbi bw’Endagamuntu y’Ekire.
• Ekibiina ekikola ku yinginiya wa yintaneeti (IETF) (Ensi yonna): RFC 6749 (Enkola y’olukusa lwa OAuth 2.0), RFC 7009 (OAuth 2.0 Token Revocation), ne RFC 8628 (OAuth 2.0 Device Authorization Grant Okulowooza ku by’okwerinda).
• Microsoft Threat Intelligence & Microsoft Entra Security Engineering (Ensi Yonna): Ekitabo ky'okuzannya eky'okuddamu ku bibaddewo ku nkola za OAuth ez'obulabe (OAuth2PermissionGrant) ne Device Code Phishing mu Microsoft Entra ID.
• Google Cloud & Google Workspace Security (Ensi Yonna): Okukakasa Obunene bwa OAuth 2.0 API, Enfuga y’Okuyingira mu App ey’Ekibiina eky’Okusatu, n’Enzimba y’Okusazaamu Token.
• National Cyber ​​Security Center (NCSC) (United Kingdom): Obulagirizi ku kulwanirira abapangisa b’ebire ku OAuth Consent Phishing n’okukozesa obubi API okuweereddwa.